ZENOTME opened a new issue, #1154: URL: https://github.com/apache/paimon-rust/issues/1154
### Search before asking - [x] I searched in the [issues](https://github.com/apache/paimon-rust/issues) and found nothing similar. ### Please describe the bug 🐞 In `pypaimon-rust==0.4.0` and current `main` (`a914bc42820b65f88e77a284edd293d347d2ebc4`), `s3_config_parse` prefers `s3.access-key` and `s3.secret-key` over their Hadoop aliases, but ignores `s3.session-token` and reads the token from `fs.s3a.session.token` instead. When both sets of keys are present with different credentials, this produces `AK_A + SK_A + TOKEN_B` rather than a consistent credential tuple. We encountered this with REST-vended credentials, resulting in S3 `403 / InvalidAccessKeyId` errors. ## Minimal reproduction Add this test to the existing test module in `crates/paimon/src/io/storage_s3.rs` (which already provides `make_props`): ```rust #[test] fn s3_session_token_should_follow_access_key_alias_precedence() { let props = make_props(&[ ("s3.access-key", "AK_A"), ("s3.secret-key", "SK_A"), ("s3.session-token", "TOKEN_A"), ("fs.s3a.access.key", "AK_B"), ("fs.s3a.secret.key", "SK_B"), ("fs.s3a.session.token", "TOKEN_B"), ]); let cfg = s3_config_parse(props).unwrap(); assert_eq!(cfg.access_key_id.as_deref(), Some("AK_A")); assert_eq!(cfg.secret_access_key.as_deref(), Some("SK_A")); // Expected: TOKEN_A. Actual in v0.4.0: TOKEN_B. assert_eq!(cfg.session_token.as_deref(), Some("TOKEN_A")); } ``` Verified locally against both tag `v0.4.0` and freshly fetched `main` at `a914bc42820b65f88e77a284edd293d347d2ebc4` (2026-10-18), using Rust 1.95.0. The AK/SK assertions pass; the session-token assertion fails: ```text assertion `left == right` failed left: Some("TOKEN_B") right: Some("TOKEN_A") test result: FAILED. 0 passed; 1 failed ``` Command: ```sh cargo +1.95.0 test -p paimon --no-default-features \ --features storage-s3,storage-fs,storage-memory --lib \ s3_session_token_should_follow_access_key_alias_precedence -- --nocapture ``` ### Solution Update `s3_config_parse` and its alias mapping to support `s3.session-token` and apply the same precedence as access key and secret key. Preserve support for dotted session-token keys when the hyphenated option is absent. With the input above, the result should be `AK_A + SK_A + TOKEN_A`. ### Are you willing to submit a PR? - [ ] I'm willing to submit a PR! -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
